Re: [PATCH] net/tls: allow limiting maximum record size

[Chuck Lever <chuck.lever@oracle.com>]

On 9/1/25 2:39 PM, Jakub Kicinski wrote:
> On Mon,  1 Sep 2025 15:36:19 +1000 Wilfred Mallawa wrote:
>> During a handshake, an endpoint may specify a maximum record size limit.
>> Currently, the kernel defaults to TLS_MAX_PAYLOAD_SIZE (16KB) for the
>> maximum record size. Meaning that, the outgoing records from the kernel
>> can exceed a lower size negotiated during the handshake. In such a case,
>> the TLS endpoint must send a fatal "record_overflow" alert [1], and
>> thus the record is discarded.
>>
>> Upcoming Western Digital NVMe-TCP hardware controllers implement TLS
>> support. For these devices, supporting TLS record size negotiation is
>> necessary because the maximum TLS record size supported by the controller
>> is less than the default 16KB currently used by the kernel.
>>
>> This patch adds support for retrieving the negotiated record size limit
>> during a handshake, and enforcing it at the TLS layer such that outgoing
>> records are no larger than the size negotiated. This patch depends on
>> the respective userspace support in tlshd [2] and GnuTLS [3].
> 
> I don't get why you are putting this in the handshake handling code.
> Add a TLS setsockopt, why any TLS socket can use, whether the socket 
> is opened by the kernel or user. GnuTLS can call it directly before 
> it returns the socket to kernel ownership.
> 
> I feel like I already commented to this effect. If you don't understand
> comments from the maintainers - ask for clarifications.

I don't recall seeing that comment before... but it makes sense to me.

After introducing the new socket option, instead of adding another
argument to the netlink protocol, just have tlshd do a setsockopt(3)
call before handing the socket back to the kernel. It already does
this to set the session key, for example.


-- 
Chuck Lever